linux-kernel - Re: [PATCH] stm class: fix device leak in open error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 17 Nov 2016 15:38:22 +0100
From:   Johan Hovold <johan@...nel.org>
To:     Alexander Shishkin <alexander.shishkin@...ux.intel.com>
Cc:     linux-kernel@...r.kernel.org, Johan Hovold <johan@...nel.org>
Subject: Re: [PATCH] stm class: fix device leak in open error path

On Tue, Nov 01, 2016 at 11:44:54AM +0100, Johan Hovold wrote:
> Make sure to drop the reference taken by class_find_device() also on
> allocation errors in open().
> 
> Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for...")
> Signed-off-by: Johan Hovold <johan@...nel.org>
> ---
>  drivers/hwtracing/stm/core.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
> index 51f81d64ca37..47811f5c9bc9 100644
> --- a/drivers/hwtracing/stm/core.c
> +++ b/drivers/hwtracing/stm/core.c
> @@ -368,8 +368,10 @@ static int stm_char_open(struct inode *inode, struct file *file)
>  		return -ENODEV;
>  
>  	stmf = kzalloc(sizeof(*stmf), GFP_KERNEL);
> -	if (!stmf)
> -		return -ENOMEM;
> +	if (!stmf) {
> +		err = -ENOMEM;
> +		goto err_put_device;
> +	}
>  
>  	stm_output_init(&stmf->output);
>  	stmf->stm = to_stm_device(dev);
> @@ -382,9 +384,10 @@ static int stm_char_open(struct inode *inode, struct file *file)
>  	return nonseekable_open(inode, file);
>  
>  err_free:
> +	kfree(stmf);
> +err_put_device:
>  	/* matches class_find_device() above */
>  	put_device(dev);
> -	kfree(stmf);
>  
>  	return err;
>  }

Any comments to this one, Alexander?

Thanks,
Johan